3777d7f607d4f967e31699f26ee34dbb1ed967f7d5641bc94d3fcca35f0d76cc

Analysis

max time kernel
306s
max time network
366s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
02-12-2022 00:12

Target

3777d7f607d4f967e31699f26ee34dbb1ed967f7d5641bc94d3fcca35f0d76cc.exe
Size

106KB
MD5

ef700a9b26ab89d6adfe98c2fef8e5a0
SHA1

ac927f151db3e86c0e5dceb9e698bc1b22deb127
SHA256

3777d7f607d4f967e31699f26ee34dbb1ed967f7d5641bc94d3fcca35f0d76cc
SHA512

11191c6f15f3db8e40927db6f3c09f11fde23967f6f1544f2d8e01b1625d96bbad34bbe52d93a41ebfd6adf7e540787fde77565cb94ef24ffc95c03436675b7b
SSDEEP

1536:aw5r6W2GObXvcxIhuLK8NT3uN6NUKlNGOTfpSDB9074Zrwg4X9wiBjqkrHZqW:nr6W2GiIIcjuWlNPRi90crwgAbqkrHYW

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1760	1548	WerFault.exe	78

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1548 wrote to memory of 1760	1548	3777d7f607d4f967e31699f26ee34dbb1ed967f7d5641bc94d3fcca35f0d76cc.exe	83
PID 1548 wrote to memory of 1760	1548	3777d7f607d4f967e31699f26ee34dbb1ed967f7d5641bc94d3fcca35f0d76cc.exe	83
PID 1548 wrote to memory of 1760	1548	3777d7f607d4f967e31699f26ee34dbb1ed967f7d5641bc94d3fcca35f0d76cc.exe	83

C:\Users\Admin\AppData\Local\Temp\3777d7f607d4f967e31699f26ee34dbb1ed967f7d5641bc94d3fcca35f0d76cc.exe
"C:\Users\Admin\AppData\Local\Temp\3777d7f607d4f967e31699f26ee34dbb1ed967f7d5641bc94d3fcca35f0d76cc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1548
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1548 -s 484
  2⤵
  - Program crash
  PID:1760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1548 -ip 1548
1⤵
PID:4388

memory/1548-132-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download
memory/1760-133-0x0000000000000000-mapping.dmp

Download